{"id":67438,"date":"2021-03-09T15:30:00","date_gmt":"2021-03-09T07:30:00","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=67438"},"modified":"2021-03-12T16:28:25","modified_gmt":"2021-03-12T08:28:25","slug":"%e8%b3%87%e5%ae%89%e8%ad%a6%e7%a4%ba%ef%bc%9amicrosoft-exchange-%e9%9b%b6%e6%99%82%e5%b7%ae-0-day-%e6%bc%8f%e6%b4%9e%e6%94%bb%e6%93%8a%e5%81%b5%e6%b8%ac%e3%80%81%e9%98%b2%e8%ad%b7%e3%80%81%e5%9b%9e","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=67438","title":{"rendered":"\u8cc7\u5b89\u8b66\u793a\uff1aMicrosoft Exchange \u96f6\u6642\u5dee (0-Day) \u6f0f\u6d1e\u653b\u64ca\u5075\u6e2c\u3001\u9632\u8b77\u3001\u56de\u61c9"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">&nbsp;<\/h1>\n\n\n\n<p><strong>\u6458\u8981<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"has-vivid-red-color has-text-color has-background\" style=\"background-color:#f9efee\">&#x26a0;  2021 \u5e74 3 \u6708 2 \u65e5\uff0cMicrosoft \u767c\u51fa\u4e86\u4e00\u4efd<a rel=\"noreferrer noopener\" href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\">\u5b89\u5168\u516c\u544a<\/a>\u8207<a rel=\"noreferrer noopener\" href=\"https:\/\/msrc-blog.microsoft.com\/2021\/03\/02\/multiple-security-updates-released-for-exchange-server\" target=\"_blank\">\u7dca\u6025\u4fee\u88dc\u66f4\u65b0<\/a>\u4f86\u89e3\u6c7a\u591a\u500b\u76ee\u524d\u6b63\u906d\u53d7\u731b\u70c8\u653b\u64ca\u7684 Microsoft Exchange Server \u4f01\u696d\u5167\u7248\u672c\u96f6\u6642\u5dee\u6f0f\u6d1e\u3002<br><br>\u53d7\u5f71\u97ff\u7684 Microsoft Exchange Server \u7248\u672c\u5305\u62ec\uff1a2010 (EOL)\u30012013\u30012016 \u4ee5\u53ca 2019\u3002<br>\u00a0<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"> \u95dc\u65bc\u9019\u9805\u653b\u64ca<\/h3>\n\n\n\n<p><br>\u516c\u544a\u4e2d\u6240\u6307\u51fa\u7684\u56db\u500b\u91cd\u5927\u6f0f\u6d1e\u5305\u62ec\u4e86\u4e00\u500b\u53ef\u8b93\u99ed\u5ba2\u5165\u4fb5\u7cfb\u7d71\u7684\u7db2\u8def\u7aef\u4f3a\u670d\u5668\u7aef\u8acb\u6c42\u507d\u9020 (SSRF) \u6f0f\u6d1e (<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26855\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-26855<\/a>)\uff0c\u4ee5\u53ca\u4e09\u500b\u53ef\u5728\u901a\u904e\u8a8d\u8b49\u4e4b\u5f8c\u767c\u52d5\u653b\u64ca\u7684\u672c\u5730\u7aef\u6f0f\u6d1e\uff1a<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26857\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-26857<\/a>\u3001<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-26858\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-26858<\/a> \u53ca <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-27065\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-27065<\/a>\u3002<br><br>\u7814\u7a76\u4eba\u54e1\u8a8d\u70ba\uff0c\u99ed\u5ba2\u662f\u85c9\u7531\u4e00\u9023\u4e32\u7684\u6f0f\u6d1e\u653b\u64ca\u624b\u6cd5\u4f86\u653b\u64ca\u542b\u6709\u9019\u4e9b\u6f0f\u6d1e\u7684 Exchange Server\uff0c\u9032\u800c\u99ed\u5165\u4f01\u696d\u7db2\u8def\u3001\u7aca\u53d6\u6a5f\u654f\u8cc7\u8a0a (\u5982\uff1a\u6240\u6709\u7684\u96fb\u5b50\u90f5\u4ef6\u4fe1\u7bb1\u8207\u901a\u8a0a\u9304)\uff0c\u4e26\u5f9e\u4e8b\u5176\u4ed6\u60e1\u610f\u6d3b\u52d5\uff0c\u5305\u62ec\uff1a\u8490\u96c6\u4f7f\u7528\u8005\u767b\u5165\u6191\u8b49\u3001\u7be1\u6539 Active Directory\u3001\u5728\u4f01\u696d\u5167\u56db\u8655\u904a\u8d70\u7b49\u7b49\u3002<br><br>\u9664\u4e86\u95b1\u8b80 Microsoft \u7684\u5b89\u5168\u516c\u544a\u4ee5\u53ca\u4e0b\u5217\u6587\u7ae0\u4e4b\u5916\uff0c\u5f37\u70c8\u5efa\u8b70\u6240\u6709\u53ef\u80fd\u53d7\u5230\u5f71\u97ff\u7684\u5ba2\u6236\u4e5f\u61c9\u53c3\u8003\u7f8e\u570b\u300c\u7db2\u8def\u8cc7\u5b89\u8207\u57fa\u790e\u67b6\u69cb\u5b89\u5168\u5c40 (Cybersecurity &amp; Infrastructure Security Agency\uff0c\u7c21\u7a31 CISA) \u6240\u767c\u5e03\u7684 <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa21-062a\" target=\"_blank\" rel=\"noreferrer noopener\">Alert AA21-0621A<\/a> \u8b66\u793a\u4f86\u7372\u5f97\u9032\u4e00\u6b65\u7684\u6307\u793a\u548c\u8cc7\u8a0a\u3002<\/p>\n\n\n\n<!--more-->\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u8a73<\/strong>\u7d30\u5167\u5bb9<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">&#x1f7e5; \u5224\u65b7\u60a8\u81ea\u5df1\u662f\u5426\u53d7\u5230\u5f71\u97ff<\/h3>\n\n\n\n<p><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft<\/a> \u8207 <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa21-062a\" target=\"_blank\" rel=\"noreferrer noopener\">CISA<\/a> \u7684\u516c\u544a\u90fd\u8a73\u7d30\u8aaa\u660e\u4e86\u9019\u9805\u653b\u64ca\u7684\u5165\u4fb5\u6307\u6a19 (IOC) \u4ee5\u53ca\u653b\u64ca\u624b\u6cd5\u3001\u6280\u5de7\u8207\u7a0b\u5e8f (TTP)\u3002<br><br>\u70ba\u4e86\u5354\u52a9 Exchange \u7cfb\u7d71\u7ba1\u7406\u54e1\u6aa2\u67e5\u81ea\u5df1\u7684\u4f3a\u670d\u5668\u662f\u5426\u906d\u5230\u5165\u4fb5\uff0c<a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/#scan-log\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Exchange Server \u5718\u968a\u7279\u5225\u88fd\u4f5c\u4e86\u4e00\u500bScript<\/a>\uff0c\u53ea\u8981\u5728 Exchange \u4f3a\u670d\u5668\u4e0a\u57f7\u884c\u9019\u500bScript\uff0c\u5c31\u80fd\u6383\u63cf\u8a18\u9304\u6a94\u5167\u662f\u5426\u6709 IOC\u3002<br><br>\u5f37\u70c8\u5efa\u8b70\u4f7f\u7528\u4f01\u696d\u5167\u7248\u672c Microsoft Exchange Server 2010 (\u6216\u66f4\u65b0\u7248\u672c) \u7684\u5ba2\u6236\u61c9\u7acb\u5373\u4f7f\u7528 Microsoft \u5de5\u5177\u6216\u5176\u4ed6\u985e\u4f3cScript\u4f86\u6aa2\u67e5\u81ea\u5df1\u662f\u5426\u53d7\u5230\u9019\u9805\u653b\u64ca\u7684\u5f71\u97ff\u3002<br><br>\u9664\u6b64\u4e4b\u5916\uff0c\u8da8\u52e2\u79d1\u6280\u7684\u4e00\u4e9b\u7522\u54c1\u4e5f\u53ef\u5354\u52a9\u5ba2\u6236\u6aa2\u67e5\u81ea\u5df1\u662f\u5426\u906d\u5230\u5165\u4fb5\uff0c\u5982\u9700\u66f4\u591a\u8cc7\u8a0a\uff0c\u8acb\u95b1\u8b80\u4ee5\u4e0b\u300c<a href=\"https:\/\/success.trendmicro.com\/solution\/000285882#TMInvestigate\"><strong><em>\u4f7f\u7528\u8da8\u52e2\u79d1\u6280\u7522\u54c1\u4f86\u6aa2\u67e5\u74b0\u5883<\/em><\/strong><\/a>\u300d\u4e00\u7bc0\u3002&nbsp;<br>&nbsp;<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">&#x1f7e5; \u842c\u4e00\u767c\u73fe\u5165\u4fb5\u6307\u6a19\u8a72\u600e\u9ebc\u8fa6\uff1f<\/h3>\n\n\n\n<p>\u7531\u65bc\u99ed\u5ba2\u5728\u5165\u4fb5\u4f01\u696d\u4e4b\u5f8c\u53ef\u80fd\u63a1\u53d6\u7684\u5f8c\u7e8c\u884c\u52d5\u56e0\u4f01\u696d\u800c\u7570\uff0c\u6240\u4ee5\uff0c\u842c\u4e00\u5ba2\u6236\u771f\u7684\u767c\u73fe\u81ea\u5df1\u6709\u906d\u5230\u653b\u64ca\u7684\u8b49\u64da\uff0c\u8da8\u52e2\u79d1\u6280\u5efa\u8b70\u4f01\u696d\u61c9\u6307\u6d3e\u5167\u90e8\u4eba\u54e1\u6216\u8058\u8acb\u5408\u683c\u7684\u8cc7\u5b89\u4e8b\u4ef6\u61c9\u8b8a\u5718\u968a\u4f86\u57f7\u884c\u4e00\u6b21\u5fb9\u5e95\u7684\u9451\u8b58\u5206\u6790\u3002<br>&nbsp;<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">&#x1f7e5; \u9632\u7bc4\u5f8c\u7e8c\u6f0f\u6d1e\u653b\u64ca<\/h3>\n\n\n\n<p>\u9996\u5148\u6700\u91cd\u8981\u7684\u4e00\u9ede\u662f\uff0c\u5f37\u70c8\u5efa\u8b70\u6240\u6709\u5ba2\u6236\u61c9\u9075\u5f9e Microsoft \u7684\u6307\u793a\uff0c\u76e1\u901f\u4fee\u88dc\u4f01\u696d\u5167\u7684 Exchange \u4f3a\u670d\u5668\u3002<br><br>\u9664\u4e86\u5957\u7528\u5ee0\u5546\u7684\u4fee\u88dc\u66f4\u65b0\u4e4b\u5916\uff0c\u8da8\u52e2\u79d1\u6280\u4e5f\u63d0\u4f9b\u4e86\u4e00\u4e9b\u5f37\u5316\u898f\u5247\u8207\u904e\u6ffe\u689d\u4ef6\uff0c\u4ee5\u53ca\u984d\u5916\u7684\u9632\u8b77\u8207\u5075\u6e2c\u529f\u80fd\u4f86\u9632\u7bc4\u9019\u9805\u653b\u64ca\u7684\u76f8\u95dc\u60e1\u610f\u5143\u4ef6\uff0c\u907f\u514d\u5c1a\u672a\u53d7\u5bb3\u7684 Exchange \u4f3a\u670d\u5668\u906d\u5230\u5f8c\u7e8c\u7684\u653b\u64ca\u3002<br><br>\u6b64\u5916\uff0cMicrosoft \u4e5f\u63d0\u4f9b\u4e86\u4e00\u4e9b<a href=\"https:\/\/msrc-blog.microsoft.com\/2021\/03\/05\/microsoft-exchange-server-vulnerabilities-mitigations-march-2021\/\" target=\"_blank\" rel=\"noreferrer noopener\">\u624b\u52d5\u9632\u7bc4\u6b65\u9a5f<\/a>\u7d66\u7121\u6cd5\u7acb\u5373\u4fee\u88dc\u7cfb\u7d71\u7684\u5ba2\u6236\u4f86\u642d\u914d\u4ee5\u4e0b\u8da8\u52e2\u79d1\u6280\u9810\u9632\u63aa\u65bd\u4f7f\u7528\u3002<br>&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">&nbsp;<\/h4>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u4f7f\u7528\u8da8\u52e2\u79d1\u6280\u7522\u54c1\u4f86\u6aa2\u67e5\u74b0\u5883<\/h3>\n\n\n\n<p><br>\u4ee5\u4e0b\u8aaa\u660e\u5e7e\u500b\u53ef\u5354\u52a9\u5ba2\u6236\u8abf\u67e5\u53ca\u77ef\u6b63\u5176\u74b0\u5883\u7684\u8da8\u52e2\u79d1\u6280\u7522\u54c1\u5075\u6e2c\/\u77ef\u6b63\u898f\u5247\u3001\u904e\u6ffe\u689d\u4ef6\u3001\u75c5\u6bd2\u78bc\u53ca\u6280\u8853\u3002<br><br><strong><em>Trend Micro Vision One<\/em><\/strong><strong><em><sup>TM<\/sup><\/em><\/strong><br><br>Trend Micro Vision One \u5e73\u53f0\u7684\u5ba2\u6236\u53ef\u4f7f\u7528\u5176\u4e2d\u7684 Apex One \u6240\u63d0\u4f9b\u7684 XDR \u5075\u6e2c\u529f\u80fd\u3002\u6b64\u5916\uff0c\u8996\u8cc7\u6599\u7684\u8490\u96c6\u6642\u9593\u7bc4\u570d\u800c\u5b9a\uff0cVision One \u5ba2\u6236\u6216\u8a31\u53ef\u6383\u63cf\u904e\u53bb\u7684\u8cc7\u6599\u770b\u770b\u662f\u5426\u6709 IOC\uff0c\u9032\u800c\u767c\u6398\u9019\u6bb5\u671f\u9593\u7684\u6f5b\u5728\u6d3b\u52d5\u4f86\u5354\u52a9\u8abf\u67e5\u3002<br><br>\u5c24\u5176\u662f\uff0cTrend Micro Vision One \u5ba2\u6236\u53ef\u5229\u7528\u5f37\u5927\u7684 Search App (\u641c\u5c0b\u61c9\u7528\u7a0b\u5f0f) \u529f\u80fd\u4f86\u5c0d\u7aef\u9ede\u6d3b\u52d5\u8cc7\u6599\u57f7\u884c\u6240\u8b02\u7684\u8cc7\u6599\u5c0d\u6620 (Data Mapping) \u67e5\u8a62\uff0c\u85c9\u7531 Microsoft \u63d0\u4f9b\u7684\u8a73\u7d30 IOC \u8cc7\u8a0a\u4f86\u627e\u5c0b\u99ed\u5ba2\u5165\u4fb5\u7684\u8b49\u64da\u3002<br>&nbsp;<\/p>\n\n\n\n<p>\u8acb\u6ce8\u610f\uff0c\u5728\u4ee5\u4e0b\u6240\u6709\u641c\u5c0b\u7576\u4e2d\uff0c\u60a8\u90fd\u53ef\u4ee5\u5229\u7528\u4e0b\u5217\u6307\u4ee4\u4f86\u5c07\u641c\u5c0b\u7bc4\u570d\u7e2e\u5c0f\u81f3\u7279\u5b9a\u7684 Exchange \u4f3a\u670d\u5668\uff1a<\/p>\n\n\n\n<p class=\"has-background\" style=\"background-color:#f3f3f3\"><br><code>\u60a8\u7684\u67e5\u8a62<\/code><code> AND endpointHostName:myExchangeServer<\/code><br>\u6216\u662f<br><code>\u60a8\u7684\u67e5\u8a62<\/code><code> AND endpointHostName:(myExchangeServer1 OR server2 OR server3)<\/code><\/p>\n\n\n\n<p><br><strong><u>\u5c0b\u627e c:\\windows\\system32\\inetsrv\\w3wp.exe \u7684\u5b50\u8655\u7406\u7a0b\u5e8f (\u4efb\u4f55\u5b50\u7a0b\u5e8f\uff0c\u5c24\u5176\u662f cmd.exe)<br><br><\/u><\/strong><br><br><em><\/em><\/p>\n\n\n\n<p><em>\u641c\u5c0b\u65b9\u5f0f\uff1a<\/em><em>EndPoint Activity Data<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>processFilePath:\"c:\\\\windows\\\\system32\\\\inetsrv\\\\w3wp.exe\" AND objectFilePath:*<\/code><\/li><li><code>processFilePath:\"c:\\\\windows\\\\system32\\\\inetsrv\\\\w3wp.exe\" AND objectFilePath:cmd.exe<\/code><\/li><\/ul>\n\n\n\n<p>\u4e0b\u5217\u67e5\u8a62\u6558\u8ff0\u4e5f\u53ef\u9054\u5230\u540c\u6a23\u6548\u679c\uff1a<\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>parentFilePath:w3wp.exe AND objectFilePath:cmd.exe<\/code><\/li><li><code>parentFilePath:w3wp.exe AND processFilePath:*<\/code><\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/success.trendmicro.com\/servlet\/rtaImage?eid=kaL4T0000000bWp&amp;feoid=00N4P00000GFzuX&amp;refid=0EM4T0000011MZG\" alt=\"image\"\/><\/figure>\n\n\n\n<p><br><br><br><strong><u>\u7531<\/u><\/strong><strong><u> w3wp.exe <\/u><\/strong><strong><u>\u6216<\/u><\/strong><strong><u> UMWorkerProcess.exe <\/u><\/strong><strong><u>\u5beb\u5165\u7cfb\u7d71\u7684\u6a94\u6848<\/u><\/strong><br><em>\u641c\u5c0b\u65b9\u5f0f\uff1aEndPoint Activity Data<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>parentFilePath:(w3wp.exe OR UMWorkerProcess.exe) AND eventSubId:101<\/code><\/li><\/ul>\n\n\n\n<p><em>\u8acb\u6ce8\u610f<\/em><em>\uff1a\u300ceventSubId 101\u300d<\/em><em>\u4ee3\u8868\u7684\u662f\u6a94\u6848\u5efa\u7acb\u4e8b\u4ef6\u3002<\/em><br><br><strong><u>\u7531\u7cfb\u7d71<\/u><\/strong><strong><u> (SYSTEM) <\/u><\/strong><strong><u>\u4f7f\u7528\u8005\u5efa\u7acb\u7684<\/u><\/strong><strong><u> ASPX <\/u><\/strong><strong><u>\u6a94\u6848<\/u><\/strong><br><em>\u641c\u5c0b\u65b9\u5f0f<\/em><em>\uff1a<\/em><em>EndPoint Activity Data<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>objectUser:SYSTEM AND objectFilePath:*.aspx<\/code><\/li><\/ul>\n\n\n\n<p><br><strong><u>\u641c\u5c0b ASP.NET\u66ab\u5b58\u6a94\u6848\u76ee\u9304\u662f\u5426\u51fa\u73fe\u65b0\u589e\u3001\u975e\u9810\u671f\u7684\u5df2\u7d44\u8b6f ASPX \u6a94\u6848<\/u><\/strong><br><em>\u641c\u5c0b\u65b9\u5f0f\uff1a<\/em><em>EndPoint Activity Data<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>objectFilePath:(\"*\\Temporary ASP.NET Files\\*\" AND \\*aspx) AND eventSubId:101<\/code><\/li><\/ul>\n\n\n\n<p><em>\u8acb\u6ce8\u610f\uff1a\u9019\u9805\u67e5\u8a62\u6558\u8ff0\u6709\u53ef\u80fd\u6703\u51fa\u73fe\u5f88\u591a\u300c\u96dc\u8a0a\u300d\u3002<\/em><\/p>\n\n\n\n<p><br><br><strong><u>\u641c\u5c0b\u99ed\u5ba2\u4f7f\u7528\u4ee5\u4e0b\u6307\u4ee4\u7684\u60c5\u6cc1\uff1anet group &#8220;Exchange Organization administrators&#8221; administrator \/del \/domain<\/u><\/strong><br><em>\u641c\u5c0b\u65b9\u5f0f\uff1aGeneral<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>ProcessName:net.exe AND CLICommand:((localgroup OR group) AND (Exchange AND \/del))<\/code><\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/success.trendmicro.com\/servlet\/rtaImage?eid=kaL4T0000000bWp&amp;feoid=00N4P00000GFzuX&amp;refid=0EM4T0000011M55\" alt=\"image.png\"\/><\/figure>\n\n\n\n<p><br><br><br><strong><u>\u641c\u5c0b\u99ed\u5ba2\u53ef\u80fd\u5728<\/u><\/strong><strong><u> Exchange <\/u><\/strong><strong><u>\u4f3a\u670d\u5668\u4e0a\u4f7f\u7528<\/u><\/strong><strong><u> 7-zip <\/u><\/strong><strong><u>\u4f86\u5c07\u8cc7\u6599\u5916\u50b3\u7684\u60c5\u6cc1<\/u><\/strong><br><em>\u641c\u5c0b\u65b9\u5f0f\uff1aGeneral<\/em><\/p>\n\n\n\n<ul class=\"has-vivid-red-color has-text-color\"><li><code>processCmd:7z.exe AND endpointHostName:myExchangeServer<\/code><\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/success.trendmicro.com\/servlet\/rtaImage?eid=kaL4T0000000bWp&amp;feoid=00N4P00000GFzuX&amp;refid=0EM4T0000011M6i\" alt=\"image.png\"\/><\/figure>\n\n\n\n<p><br><strong><u>\u641c\u5c0b Exchange \u4f3a\u670d\u5668\u4e0a\u662f\u5426\u6709\u8490\u96c6\u767b\u5165\u6191\u8b49\u7684\u72c0\u6cc1<\/u><\/strong><br>\u9664\u4e86\u4f7f\u7528 Search App \u4e4b\u5916\uff0c\u7cfb\u7d71\u7ba1\u7406\u54e1\u9084\u53ef\u4ee5\u5230 \u00a0Vision One \u4e3b\u63a7\u53f0\u4e0a\u7684 <strong>Observed Attack Techniques <\/strong>(\u89c0\u5bdf\u5230\u7684\u653b\u64ca\u6280\u5de7) \u5340\u6bb5\u7684\u904e\u6ffe\u689d\u4ef6\u4e2d\u9375\u5165\uff1a\u300c<code>dump\u300d<\/code>\u3002\u60a8\u4e5f\u53ef\u4ee5\u5728\u7aef\u9ede\u540d\u7a31\u6b04\u4f4d\u8f38\u5165 Exchange \u4f3a\u670d\u5668\u540d\u7a31\u4f86\u7e2e\u5c0f\u641c\u5c0b\u7bc4\u570d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/success.trendmicro.com\/servlet\/rtaImage?eid=kaL4T0000000bWp&amp;feoid=00N4P00000GFzuX&amp;refid=0EM4T0000011MDT\" alt=\"image.png\"\/><\/figure>\n\n\n\n<p><br><br><br>\u5982\u9700\u6709\u95dc Search App \u7684\u8a73\u7d30\u8cc7\u8a0a\uff0c\u5305\u62ec\u67e5\u8a62\u6307\u4ee4\u7684\u8a9e\u6cd5\u8207\u8cc7\u6599\u5c0d\u6620\uff0c\u8acb\u81f3<a rel=\"noreferrer noopener\" href=\"https:\/\/docs.trendmicro.com\/en-us\/enterprise\/trend-micro-xdr-online-help\/apps\/search-app\/data-mapping-endpoi.aspx\" target=\"_blank\">\u8da8\u52e2\u79d1\u6280\u7dda\u4e0a\u5354\u52a9\u4e2d\u5fc3<\/a>\uff0c\u6b64\u5916\u672c\u6587\u4e5f\u6703\u4e0d\u6642\u63d0\u4f9b\u66f4\u591a\u65b0\u7684\u67e5\u8a62\u6307\u4ee4\u3002<br><br><br><strong><em>\u8da8\u52e2\u79d1\u6280 Worry-Free Business Security Services<\/em><\/strong><br><br>\u4e2d\u5c0f\u4f01\u696d\u5ba2\u6236\u4ee5\u53ca\u5176\u4ed6\u4f7f\u7528\u8da8\u52e2\u79d1\u6280 Worry-Free Business Security Services \u5e73\u53f0\u7684\u670d\u52d9\u4f9b\u61c9\u5546\uff0c\u4e5f\u53ef\u5229\u7528\u8a72\u7522\u54c1\u5167\u5efa\u7684 XDR \u529f\u80fd\u4f86\u641c\u5c0b\u76f8\u95dc\u7684\u6307\u6a19\u3002<br><br><br><strong><em>Trend Micro Cloud One <\/em><\/strong>\u2013 <strong><em>Workload Security \u8207 Deep Security Integrity Monitoring (IM) \u898f\u5247<\/em><\/strong><br><br>\u4ee5\u4e0b\u9019\u689d\u898f\u5247\u53ef\u5728\u906d\u5230\u6f0f\u6d1e\u653b\u64ca\u4e4b\u5f8c\u5354\u52a9\u7cfb\u7d71\u7ba1\u7406\u54e1\u6839\u64da Microsoft \u516c\u544a\u6240\u63d0\u4f9b\u7684\u8cc7\u8a0a\u4f86\u5075\u6e2c\u5df2\u77e5\u7684\u7db2\u7ad9\u6307\u4ee4\u6a94 (web shell)\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/success.trendmicro.com\/servlet\/rtaImage?eid=kaL4T0000000bWp&amp;feoid=00N4P00000GFzuX&amp;refid=0EM4T0000011MDJ\" alt=\"image.png\"\/><\/figure>\n\n\n\n<ul><li>1010855 &#8211; Microsoft Exchange &#8211; HAFNIUM Targeted Vulnerabilities<\/li><\/ul>\n\n\n\n<p><em>\u8acb\u6ce8\u610f\uff0c\u9019\u689d\u898f\u5247\u6703\u5efa\u7acb\u4e00\u500b\u57fa\u6e96\u9ede\uff0c\u65e5\u5f8c\u82e5\u6709\u4efb\u4f55\u8b8a\u66f4\u5c31\u6703\u767c\u51fa\u8b66\u793a\uff0c\u56e0\u6b64\u5b83\u6240\u63d0\u4f9b\u7684\u8cc7\u6599\u5c07\u8996\u898f\u5247\u672c\u8eab\u7684\u4f48\u7f72\u6642\u9593\u9ede\u800c\u7570\u3002\u5982\u679c\u5728\u906d\u5230\u5165\u4fb5\u4e4b\u524d\u5c31\u5df2\u4f48\u7f72\uff0c\u90a3\u5b83\u5c31\u80fd\u91dd\u5c0d\u6f5b\u5728\u7684\u8b8a\u66f4\u8207\u5075\u6e2c\u4e8b\u4ef6\u767c\u51fa\u8b66\u793a\u3002\u4f46\u5c31\u7b97\u6b64\u898f\u5247\u662f\u5728\u906d\u5230\u6f0f\u6d1e\u653b\u64ca\u4e4b\u5f8c\u624d\u4f48\u7f72\uff0c\u5b83\u9084\u662f\u53ef\u4ee5\u7d93\u7531\u57fa\u6e96\u9ede\u6aa2\u8996\u5668 (baseline viewer) \u63d0\u4f9b\u4e00\u4e9b\u91cd\u8981\u8cc7\u6599\uff0c\u4f8b\u5982\uff1a\u76e3\u8996\u4e2d\u7684\u6a94\u6848\u6e05\u55ae\u3002<\/em><br><br><br><strong><em>Trend Micro Cloud One <\/em><\/strong>\u2013 <strong><em>Network Security \u8207 TippingPoint Chopper Detection Filters<\/em><\/strong><br><br>\u4ee5\u4e0b\u5075\u6e2c\u898f\u5247\u53ef\u5728\u906d\u53d7\u6f0f\u6d1e\u653b\u64ca\u4e4b\u5f8c\u641c\u5c0b\u8207\u653b\u64ca\u884c\u52d5\u7684\u76f8\u95dc Chopper \u7db2\u7ad9\u6307\u4ee4\u6a94\u6d3b\u52d5\uff1a<\/p>\n\n\n\n<ul><li>26898:Tunneling: reGeorg SOCKS Proxy Checkin Traffic<\/li><li>26899:Tunneling: reGeorg SOCKS Proxy Traffic Checkin Response<\/li><li>26900:Tunneling: reGeorg SOCKS Proxy Sending Command Traffic<\/li><li>34152:HTTP:China Chopper PHP Webshell Traffic Detected (My Script RunInBrowser Control Command)<\/li><li>34153:HTTP:China Chopper PHP Webshell Traffic Detected (Control Commands)<\/li><li>34154:HTTP:China Chopper ASP Webshell Traffic Detected (Control Commands)<\/li><li>34257:HTTP:China Chopper ASPX Webshell Traffic Detected (Control Commands)<\/li><li>35779:HTTP:China Chopper ASP\/JSP Webshell Payload Detection<\/li><li>36192:HTTP:China Chopper ASP Webshell Payload Only Detection<\/li><\/ul>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">\u9810\u9632\u6027\u898f\u5247\u8207\u904e\u6ffe\u689d\u4ef6<\/h3>\n\n\n\n<p><br>\u4ee5\u4e0b\u898f\u5247\u3001\u904e\u6ffe\u689d\u4ef6\u548c\u75c5\u6bd2\u78bc\u53ef\u8b93\u5ba2\u6236\u642d\u914d\u7cfb\u7d71\u4fee\u88dc\u8207\u5176\u4ed6\u624b\u52d5\u6b65\u9a5f\u4f86\u9632\u7bc4\u6700\u65b0\u6216\u9032\u4e00\u6b65\u7684\u6f0f\u6d1e\u653b\u64ca\u884c\u70ba\u3002<br><br><strong><em>Trend Micro Cloud One <\/em><\/strong>\u2013 <strong><em>Workload Security \u8207 Deep Security IPS \u898f\u5247<\/em><\/strong><\/p>\n\n\n\n<ul><li>Rule 1010854 &#8211; Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)<\/li><\/ul>\n\n\n\n<p><br><strong><em>Trend Micro Cloud One <\/em><\/strong>\u2013 <strong><em>Network Security \u8207 TippingPoint IPS \u898f\u5247<\/em><\/strong><\/p>\n\n\n\n<ul><li>Filter 39101:HTTP:Microsoft Exchange Server-Side Request Forgery Vulnerability<\/li><\/ul>\n\n\n\n<p><br><strong><em>\u8da8\u52e2\u79d1\u6280\u60e1\u610f\u7a0b\u5f0f\u5075\u6e2c\u75c5\u6bd2\u78bc (VSAPI\u3001\u6a5f\u5668\u5b78\u7fd2\u8207\u884c\u70ba\u76e3\u63a7)<\/em><\/strong><\/p>\n\n\n\n<ul><li>\u9019\u9805\u653b\u64ca\u76ee\u524d\u5df2\u77e5\u7684\u7db2\u7ad9\u6307\u4ee4\u6a94\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba\uff1a<strong>Backdoor.ASP.SECCHECHECKER.A<\/strong>\uff1b\u800c\u76f8\u95dc\u7684\u60e1\u610f\u5de5\u5177\u5247\u547d\u540d\u70ba\uff1a<strong>HackTool.PS1.PowerCat.A<\/strong>\u3002<\/li><\/ul>\n\n\n\n<p><br>\u8da8\u52e2\u79d1\u6280\u76ee\u524d\u4ecd\u5728\u7a4d\u6975\u5c0b\u627e\u5176\u4ed6\u5f62\u5f0f\u7684\u5075\u6e2c\u53ca\u9632\u8b77\u65b9\u6cd5\u4f86\u5354\u52a9\u5ba2\u6236\u5c0d\u6297\u9019\u9805\u653b\u64ca\uff0c\u4f46\u6211\u5011\u4ecd\u8981\u518d\u6b21\u5f37\u8abf\uff0c\u6700\u91cd\u8981\u9084\u662f\u8981\u76e1\u901f\u5957\u7528 Microsoft \u5b98\u65b9\u91cb\u51fa\u7684\u4fee\u88dc\u66f4\u65b0\u3002\u672a\u4f86\u8acb\u6301\u7e8c\u95dc\u6ce8\u6211\u5011\uff0c\u4e00\u6709\u65b0\u7684\u9632\u8b77\u65b9\u6cd5\uff0c\u6211\u5011\u5c07\u7acb\u5373\u901a\u77e5\u5ba2\u6236\u4e26\u66f4\u65b0\u9019\u7bc7\u6587\u7ae0\u3002<br>\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><br>&#x1f7e5;\u53c3\u8003\u9023\u7d50<\/h3>\n\n\n\n<ul><li><a rel=\"noreferrer noopener\" href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/c\/microsoft-exchange-attack.html\" target=\"_blank\"><a href=\"https:\/\/blog.trendmicro.com.tw\/?p=67338\">Microsoft Exchange \u906d\u5230\u8972\u64ca\uff1a\u6211\u662f\u5426\u53d7\u5230\u5f71\u97ff\uff0c\u4e0b\u4e00\u6b65\u8a72\u600e\u9ebc\u505a\uff1f<\/a><\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/\" target=\"_blank\">Microsoft Advisory &#8211; HAFNIUM targeting Exchange Servers with 0-day exploits<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/us-cert.cisa.gov\/ncas\/alerts\/aa21-062a\" target=\"_blank\">CISA Alert AA21-0621A<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/03\/02\/hafnium-targeting-exchange-servers\/#scan-log\" target=\"_blank\">Microsoft Exchange Server exploitation detection script<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/msrc-blog.microsoft.com\/2021\/03\/05\/microsoft-exchange-server-vulnerabilities-mitigations-march-2021\/\" target=\"_blank\">Microsoft Exchange Server Vulnerabilities (manual) Mitigations<\/a><\/li><\/ul>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>\u539f\u6587\u51fa\u8655\uff1a<a href=\"https:\/\/success.trendmicro.com\/solution\/000285882\">SECURITY ALERT: Microsoft Exchange 0-Day Exploit Detection, Protection and Response<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; \u6458\u8981 &#x26a0; 2021 \u5e74 3 \u6708 2 \u65e5\uff0cMicrosoft \u767c\u51fa\u4e86\u4e00\u4efd\u5b89\u5168\u516c\u544a\u8207\u7dca [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_wpscppro_dont_share_socialmedia":false,"_wpscppro_custom_social_share_image":0,"_facebook_share_type":"","_twitter_share_type":"","_linkedin_share_type":"","_pinterest_share_type":"","_linkedin_share_type_page":"","_instagram_share_type":"","_medium_share_type":"","_threads_share_type":"","_google_business_share_type":"","_selected_social_profile":[],"_wpsp_enable_custom_social_template":false,"_wpsp_social_scheduling":{"enabled":false,"datetime":null,"platforms":[],"status":"template_only","dateOption":"today","timeOption":"now","customDays":"","customHours":"","customDate":"","customTime":"","schedulingType":"absolute"},"_wpsp_active_default_template":true},"categories":[4759,1798,1799,156,179],"tags":[4757,100,4760],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/67438"}],"collection":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=67438"}],"version-history":[{"count":2,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/67438\/revisions"}],"predecessor-version":[{"id":67440,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/67438\/revisions\/67440"}],"wp:attachment":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=67438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=67438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=67438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}